Hacking A little bit of 3ds ROM hacking

[FAST6191]

Following a conversation the other day about developer games and their using different encryption I set off down the internet highway in an attempt to procure said developer games and after a cheesy montage sequence my reward was a copy of the files (sadly no binary but that looks to be kept somewhat further apart) from the pyramids demo in plaintext. I have only looked at it for a few hours thus far but it appears to be similar enough to the DS to allow people to jump across yet it will probably be hex editors for the time being.

Spoiler: File name listing

Directory of pyramids
Environment
loc
Lyt
Objects
Particules
shaders
sound
7,576 InputImage.bmp
964 nwfont_RectDrawerShader.shbin
484 nwfont_TextWriterShader.shbin
3,652 nwgfx_ParticleDefaultShader.bcsdr
4 File(s) 12,676 bytes

Directory of pyramids\Environment

495 BG.bcresX
pyramids
1 File(s) 495 bytes

Directory of pyramids\Environment\pyramids

15,387 arbre.bcsklaX
223 ciel.bcmataX
211,802 ecran_01.bcresX
11,287 ecran_05_particule.bcresX
581 Omni02.LightAnimation.bcenv
954 Omni_ecran_04.LightAnimation.bcenv
970 Omni_ecran_06.LightAnimation.bcenv
11,032 palmier.bcsklaX
477 press_start.bcmataX
193,767 press_start.bcresX
22,763 press_start.bcsklaX
557 press_start2.bcmataX
199,577 press_start2.bcresX
22,761 press_start2.bcsklaX
9,733 press_start_particle.bcresX
312,242 pyramids.bcresX
314 sable.bcmataX
314 sable2.bcmataX
18 File(s) 1,014,741 bytes

Directory of pyramids\loc

3,573 pyramids_DE.LOC
2,905 pyramids_E2.LOC
3,507 pyramids_ES.LOC
2,905 pyramids_F2.LOC
3,520 pyramids_FR.LOC
2,923 pyramids_ID.LOC
3,450 pyramids_IT.LOC
3,521 pyramids_NL.LOC
3,431 pyramids_OR.LOC
2,905 pyramids_U2.LOC
2,923 pyramids_UK.LOC
2,782 pyramids_US.LOC
12 File(s) 38,345 bytes

Directory of pyramids\Lyt

3,071 HomeNixSign.arcX
23,094 noir_bot.arcX
23,100 noir_top.arcX
23,100 overlay_pyramids.arcX
116,149 pyramids_capture.arcX
64,148 pyramids_capture_top01.arcX
1,435 pyramids_capture_top02.arcX
89,912 pyramids_controls.arcX
77,330 pyramids_controls_demo.arcX
282,154 pyramids_credits.arcX
71,665 pyramids_ecran_bas_select_level.arcX
74,034 pyramids_ecran_bas_select_level_custom.arcX
28,249 pyramids_ecran_bas_select_level_fond.arcX
3,107 pyramids_fade_ecran_bas.arcX
1,033 pyramids_fade_ecran_haut.arcX
213,037 pyramids_fresque.arcX
109,729 pyramids_ingame.arcX
71,603 pyramids_menu.arcX
152,591 pyramids_pause_et_stats.arcX
158,492 pyramids_promo_bot.arcX
567,194 pyramids_promo_top.arcX
435,653 pyramids_promo_top2.arcX
57,855 pyramids_select_level.arcX
49,169 pyramids_select_level_custom.arcX
3,187 pyramids_select_level_fleches.arcX
28,280 pyramids_select_level_fond.arcX
27,202 pyramids_select_level_fond_gris.arcX
27 File(s) 2,755,573 bytes

Directory of pyramids\Objects


pyramids
0 File(s) 0 bytes

Directory of pyramids\Objects\pyramids


351 aventurier2_idle.bcmataX
9,028 aventurier2_idle.bcresX
346 aventurier_accroupi.bcmataX
8,515 aventurier_accroupi.bcresX
353 aventurier_accroupi_bloc.bcmataX
8,355 aventurier_accroupi_bloc.bcresX
352 aventurier_accroupi_idle.bcmataX
8,263 aventurier_accroupi_idle.bcresX
288 aventurier_accroupi_tir.bcmataX
8,349 aventurier_accroupi_tir.bcresX
348 aventurier_amorce_saut.bcmataX
8,522 aventurier_amorce_saut.bcresX
346 aventurier_bloc.bcmataX
9,088 aventurier_bloc.bcresX
327 aventurier_idle.bcmataX
28,160 aventurier_idle.bcmdl
8,964 aventurier_idle.bcresX
390 aventurier_marche.bcmataX
9,948 aventurier_marche.bcresX
243 aventurier_mort.bcmataX
11,504 aventurier_mort.bcresX
2,908 aventurier_mort.bcsklaX
342 aventurier_saut.bcmataX
8,360 aventurier_saut.bcresX
346 aventurier_saut_bloc.bcmataX
8,479 aventurier_saut_bloc.bcresX
393 aventurier_saut_tir.bcmataX
8,611 aventurier_saut_tir.bcresX
387 aventurier_tir.bcmataX
9,281 aventurier_tir.bcresX
7,302 balle.bcresX
7,777 bloc.bcresX
8,582 bloc2.bcresX
7,922 boulepique.bcresX
1,430 boulepique_deplacement_d.bcsklaX
1,430 boulepique_deplacement_g.bcsklaX
311 boulepique_mort.bcmataX
21,470 boulepique_mort.bcresX
10,280 boule_de_feu.bcresX
2,371 boule_de_feu.bcsklaX
227 boutonA1.bcmataX
11,429 boutonA1.bcresX
1,364 boutonA1.bcsklaX
256 boutonA2.bcmataX
10,965 boutonA2.bcresX
1,365 boutonA2.bcsklaX
7,800 brique.bcresX
7,755 brique2.bcresX
7,802 brique3.bcresX
7,650 brique4.bcresX
14,337 cadre.bcresX
14,229 cartouche.bcresX
3,859 cartouche.bcsklaX
226 cle.bcmataX
20,336 cle.bcresX
7,071 cle.bcsklaX
8,464 colonne1.bcresX
7,958 colonne2.bcresX
34,432 Copie de crane_mort_particle.bcres
23,936 Copie de crane_particle.bcres
8,856 coupelle.bcresX
269 crane_deplacement_h.bcmataX
9,691 crane_deplacement_h.bcresX
320 crane_deplacement_v.bcmataX
9,635 crane_deplacement_v.bcresX
15,553 crane_mort.bcresX
6,471 crane_mort.bcsklaX
12,733 crane_mort_particle.bcresX
9,697 crane_particle.bcresX
54,449 effet_temps.bcresX
28,512 effet_temps.bcsklaX
297 fonte_chiffre_1.bcmataX
7,919 fonte_chiffre_1.bcresX
301 fonte_chiffre_2.bcmataX
7,921 fonte_chiffre_2.bcresX
301 fonte_chiffre_3.bcmataX
7,923 fonte_chiffre_3.bcresX
301 fonte_chiffre_4.bcmataX
7,923 fonte_chiffre_4.bcresX
301 fonte_chiffre_5.bcmataX
7,923 fonte_chiffre_5.bcresX
301 fonte_chiffre_6.bcmataX
7,923 fonte_chiffre_6.bcresX
301 fonte_chiffre_7.bcmataX
7,923 fonte_chiffre_7.bcresX
11,991 gargouilleb.bcresX
858 gargouilleb.bcsklaX
12,517 gargouilled.bcresX
921 gargouilled.bcsklaX
12,350 gargouilleg.bcresX
857 gargouilleg.bcsklaX
11,977 gargouilleh.bcresX
858 gargouilleh.bcsklaX
7,460 gbrique1a.bcresX
7,432 gbrique1b.bcresX
7,483 gbrique1c.bcresX
7,414 gbrique1d.bcresX
7,661 gbrique2a.bcresX
7,651 gbrique2b.bcresX
7,688 gbrique2c.bcresX
7,681 gbrique2d.bcresX
7,660 gbrique3a.bcresX
7,676 gbrique3b.bcresX
7,670 gbrique3c.bcresX
7,697 gbrique3d.bcresX
15,562 overlay.bcresX
2,525 overlay.bcsklaX
8,819 piques.bcresX
395 piques.bcsklaX
394 piques1.bcsklaX
216 porte.bcmataX
21,518 porte.bcresX
244 porte_ouverte_idle.bcmataX
35 porte_ouverte_idle.bcsklaX
233 porte_ouverture.bcmataX
903 porte_ouverture.bcsklaX
9,468 rocher.bcresX
220 rocher_apparition.bcmataX
717 rocher_apparition.bcsklaX
474 rocher_chute.bcsklaX
1,283 rocher_deplacement_d.bcsklaX
1,295 rocher_deplacement_g.bcsklaX
7,572 rocher_impact_particle.bcresX
9,639 rocher_mort_particle.bcresX
15,482 sablier.bcresX
3,867 sablier.bcsklaX
18,692 scarabe.bcresX
3,439 scarabe.bcsklaX
326 scarabe_vole.bcmataX
10,952 scarabe_vole.bcresX
26,310 scarabe_vole_mort.bcresX
273 serpent_chute.bcmataX
8,886 serpent_chute.bcresX
270 serpent_crache.bcmataX
8,693 serpent_crache.bcresX
260 serpent_deplacement.bcmataX
9,504 serpent_deplacement.bcresX
272 serpent_idle.bcmataX
8,412 serpent_idle.bcresX
394 serpent_mort.bcmataX
9,927 serpent_mort.bcresX
8,053 spawn_tete.bcresX
7,723 tiret.bcresX
8,093 tnt.bcresX
252 tnt_declencheur.bcmataX
14,269 tnt_declencheur.bcresX
315 tnt_declencheur_action.bcmataX
15,119 tnt_declencheur_action.bcresX
944 tnt_declencheur_action.bcsklaX
24,071 tnt_explosion.bcresX
11,194 tresor1.bcresX
3,428 tresor1.bcsklaX
11,528 tresor2.bcresX
3,873 tresor2.bcsklaX
11,857 tresor3.bcresX
3,873 tresor3.bcsklaX
11,424 tresor4.bcresX
3,428 tresor4.bcsklaX
11,701 tresor5.bcresX
3,869 tresor5.bcsklaX
160 File(s) 1,141,214 bytes

Directory of pyramids\Particules


pyramids
0 File(s) 0 bytes

Directory of pyramids\Particules\pyramids


31,616 bloc2_particle.bcres
24,448 bloc3_particle.bcres
21,376 bloc_particle.bcres
24,576 bonus_particle.bcres
23,936 boulefeu_gargouille_fin.bcres
23,936 boulefeu_gargouille_particle.bcres
32,384 boulefeu_joueur.bcres
23,936 boulefeu_particle.bcres
23,936 crachat_fin_particle.bcres
23,936 crachat_particle.bcres
34,432 crane_mort_particle.bcres
23,936 crane_particle.bcres
29,952 ecran_02_particule.bcres
23,680 ecran_03_particule.bcres
39,296 ecran_04_particule.bcres
28,928 ecran_05_particule.bcres
23,936 feu_particle.bcres
22,400 fumee_Particle.bcres
32,896 halo.bcres
29,440 projectile.bcres
23,936 projectile_fin.bcres
20,736 rocher_impact_particle.bcres
34,944 rocher_mort_particle.bcres
32,896 scarabe_halo.bcres
77,568 scarabe_vole_mort.bcres
39,040 tir.bcres
81,792 tnt_explosion.bcres
27 File(s) 853,888 bytes

Directory of pyramids\shaders


964 nwfont_RectDrawerShader.shbin
484 nwfont_TextWriterShader.shbin
328 nwlyt_ConstColorShader.shbin
1,060 nwlyt_PaneShader.shbin
4 File(s) 2,836 bytes

Directory of pyramids\sound


816,896 classics.bcsar
2,852 classics.csid
4,443 classics.xml
stream
3 File(s) 824,191 bytes

Directory of pyramids\sound\stream


3,244,128 STRM_PYRAMID_MENU.bcstm
1 File(s) 3,244,128 bytes

Total Files Listed:
257 File(s) 9,888,087 bytes
35 Dir(s)

Many things of interest in there, the basic TAR and have a look did not net anything of great interest but what looks like the classic LZ fingerprints are there (a bit more on that later) which probably made for that result.

Sample from overlay.bcsklaX

0000000000 1180 1100 0043 4746 58FF FE14 0000 0000 .....CGFX.......
0000000010 0005 8011 0000 4101 2009 4441 5441 6C20 ......A. .DATAl 
0000000020 0BD0 0370 0130 5334 0220 4E44 4943 5443 ...p.0S4. NDICTC
0000000030 2C60 3FFF FFFF FF30 9B70 9541 3660 5994 ,`?....0.p.A6`Y.
0000000040 1000 0004 20BD 0943 414E 4D20 C406 8420 .... ..CANM ... 
0000000050 0F62 8820 1350 2BC8 4202 20D9 0CBA E053 .b. .P+.B. ....S
0000000060 3C20 ED30 17F0 533D 40F2 0234 005A 2053 < [email protected] S
0000000070 3111 3A40 BB02 0041 5320 6318 0800 0028 1.:@...AS c....(
0000000080 2125 5F3E 206F 3A20 7331 3020 12C0 5B51 !%_> o: s10 ..[Q
0000000090 3120 C842 7139 B254 343F 3B00 6E7C 3DFD 1 .Bq9.T4?;.n|=.
00000000A0 6D7C 3D86 C020 0B31 644D 5634 3F93 4716 m|=.. .1dMV4?.G.
00000000B0 7B3D 5620 0322 200B 3178 6600 5934 3F5F {=V ." .1xf.Y4?_
00000000C0 0C79 3D23 B020 033A 200B 318C E15D 343F .y=#. .: .1..]4?
00000000D0 05CC C775 3D90 2003 B720 0B80 31A0 A363 ...u=. .. ..1..c
00000000E0 343F FD84 712C 3DC3 2003 7820 0B31 B489 4?..q,=. .x .1..
00000000F0 6A00 343F 144F 6C3D DB4E 186C 3D5E 200B j.4?.Ol=.N.l=^ .
0000000100 31C8 7172 3400 3F37 3166 3DFF 3066 303D 1.qr4.?71f=.0f0=
0000000110 4620 0B31 DC35 7B34 3F05 8336 5F3D 4C20 F .1.5{4?..6_=L 
0000000120 030B 200B 9031 F0B0 8420 3B6A 573D DF0C .. ..1... ;jW=..
0000000130 6957 3D84 200B 3204 B68E 0034 3F0B D74E iW=. .2....4?..N
0000000140 3DD9 D618 4E3D 8B20 0B32 1822 9934 023F =...N=. .2.".4.?
0000000150 8A88 453D 5920 03F7 4098 50C7 C9A3 343F ..E=Y [email protected]?
0000000160 B589 163B 3D87 2003 9F20 0B32 4085 00AE ...;=. .. .2@...
0000000170 343F B4E5 303D 89B0 2003 5A20 0B32 542D 4?..0=.. .Z .2T-
0000000180 B934 3F05 B3A7 253D 8A20 0303 200B 8032 .4?...%=. .. ..2
0000000190 689B C334 3FE1 DA19 2C3D BB20 0371 200B h..4?...,=. .q .
00000001A0 327C ABCD 0134 3F72 8A0D 3D4F 2003 6080 2|...4?r..=O .`.
00000001B0 200B 3290 39D7 343F A20B C100 3D82 2003  .2.9.4?....=. .

Even with compression (although it starts with 11 the few files tested seemed incompatible with the type 11 DS compression) the few magic stamps are evident and 1180 hex is a good length for the file not to mention 8011 appearing several bytes later which is a pattern repeated by the other files looked at.

It will have to be investigated further but even the smallest files (usually good candidates for skipping compression owing to a lack of gains achieved) seem to be compressed. The compression looks like it will have to be manually stepped through.
The question of whether arcX is the new NARC/ARC/CARC has all signs point to yes- multiple compressed magic stamps and what could be names follow in the file.

The loc files has some ASCII in them that appeared to correspond to the names of the languages they come from although they appeared to be closer to variable names and developer notes than game text.

The thing many eyes would have been drawn to though is the sound stuff with BCSAR seemingly being the main file and first of all yes it looks very much like SDAT (although maybe a bit lighter on the header definitions of things to follow). As an added bonus there appears to be both an XML file that might have been fed into something and what might be the intermediate format said tools spat out- developer left extras before we can even decrypt 3DS ROM images.

Sample of the XML file, initial header split across lines to help the forum.

<?xml version="1.0"?>
<SoundArchiveBinary xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" 
xmlns:xsd="http://www.w3.org/2001/XMLSchema" Name="classics"
xmlns="NintendoWare.SoundFoundation.FileFormats.NintendoWareBinary"> 
<Sounds>
<StreamSound ID="01000000" Name="STRM_MUSIC_BHURMA" FileID="00000000" />
<StreamSound ID="01000001" Name="STRM_PYRAMID_MENU" FileID="00000001" />
<StreamSound ID="01000002" Name="STRM_PYRAMID_CREDITS" FileID="00000002" />
<WaveSound ID="01000003" Name="WSD_PYRAMIDS_GRABAMMO" />
<WaveSound ID="01000004" Name="WSD_PYRAMIDS_ALLTREASURES" />
<WaveSound ID="01000005" Name="WSD_PYRAMIDS_GUN" />
<WaveSound ID="01000006" Name="WSD_PYRAMIDS_IMPACT" />
<WaveSound ID="01000007" Name="WSD_PYRAMIDS_CRACHEURDEATH" />
<WaveSound ID="01000008" Name="WSD_PYRAMIDS_CREATEBRICK" />
<WaveSound ID="01000009" Name="WSD_PYRAMIDS_HIGHJUMPIMPACT" />
<WaveSound ID="0100000A" Name="WSD_PYRAMIDS_DEATH" />
<WaveSound ID="0100000B" Name="WSD_PYRAMIDS_CLOCK" />
<WaveSound ID="0100000C" Name="WSD_PYRAMIDS_DESTROYBRICK" />
<WaveSound ID="0100000D" Name="WSD_PYRAMIDS_TRIGGER" />
..
..
..
..
..
..
<WaveSound ID="01000027" Name="WSD_PYRAMIDS_SCARABBUZZLOOP" />
<WaveSound ID="01000028" Name="WSD_PYRAMIDS_SCARABDEATH" />
</Sounds>
<SoundGroups>
<SoundGroup ID="02000000" Name="WSDSET_0" FileID="00000003" />
</SoundGroups>
<SoundSetBanks />
<Players>
<Player ID="04000000" Name="PLAYER_0" />
</Players>
<WaveArchives>
<WaveArchive ID="05000000" Name="WSDSET_0_WaveArchive@AutoGenerated" />
</WaveArchives>
<Groups />
<Files>
<InternalFile ID="00000000" Name="stream/STRM_MUSIC_BHURMA.bcstm" />
<InternalFile ID="00000001" Name="stream/STRM_PYRAMID_MENU.bcstm" />
<InternalFile ID="00000002" Name="stream/STRM_PYRAMID_CREDITS.bcstm" />
<InternalFile ID="00000003" Name="../cache/WSDSET_0.bcwsd" Size="5832" />
<InternalFile ID="00000004" Name="../cache/[email protected]" Size="803072" />
</Files>
<ElementMap>
<Root Address="00000000" Size="816896" Name="SoundArchiveBinaryFile">
<Items>
<ElementMapItem Address="00000000" Size="56" Name="BinaryHeader" />
<ElementMapItem Address="00000040" Size="3196" Name="StringBlock" />
<ElementMapItem Address="00000CC0" Size="4656" Name="InfoBlock" />
<ElementMapItem Address="00001F00" Size="808960" Name="FileBlock">
<Items>
<FileElementMapItem Address="00001F20" Size="5832" Name="../cache/WSDSET_0.bcwsd" FileID="00000003" />
<FileElementMapItem Address="00003600" Size="803072" Name="../cache/[email protected]" FileID="00000004" />
</Items>
</ElementMapItem>
</Items>
</Root>
</ElementMap>
</SoundArchiveBinary>

Sample of the CSID

// SoundIDs
static const unsigned int STRM_MUSIC_BHURMA = 0x01000000;
static const unsigned int STRM_PYRAMID_MENU = 0x01000001;
static const unsigned int STRM_PYRAMID_CREDITS = 0x01000002;
static const unsigned int WSD_PYRAMIDS_GRABAMMO = 0x01000003;
static const unsigned int WSD_PYRAMIDS_ALLTREASURES = 0x01000004;
static const unsigned int WSD_PYRAMIDS_GUN = 0x01000005;
static const unsigned int WSD_PYRAMIDS_IMPACT = 0x01000006;
static const unsigned int WSD_PYRAMIDS_CRACHEURDEATH = 0x01000007;
..
..
..
..
..
static const unsigned int WSD_PYRAMIDS_QRCODESUCCESS = 0x01000026;
static const unsigned int WSD_PYRAMIDS_SCARABBUZZLOOP = 0x01000027;
static const unsigned int WSD_PYRAMIDS_SCARABDEATH = 0x01000028;

// SoundGroupIDs
// WaveSoundSetIDs
static const unsigned int WSDSET_0 = 0x02000000;
// SequenceSoundSetIDs

// BankIDs

// PlayerIDs
static const unsigned int PLAYER_0 = 0x04000000;

// WaveArchiveIDs

// GroupIDs

Spoiler: First few results of a strings search in the BCSAR file

0x00000000 0x00000004 CSAR
0x00000040 0x00000004 STRG
0x00000260 0x00000011 STRM_MUSIC_BHURMA
0x00000272 0x00000011 STRM_PYRAMID_MENU
0x00000284 0x00000014 STRM_PYRAMID_CREDITS
0x00000299 0x00000015 WSD_PYRAMIDS_GRABAMMO
0x000002AF 0x00000019 WSD_PYRAMIDS_ALLTREASURES
0x000002C9 0x00000010 WSD_PYRAMIDS_GUN
0x000002DA 0x00000013 WSD_PYRAMIDS_IMPACT
0x000002EE 0x0000001A WSD_PYRAMIDS_CRACHEURDEATH
0x00000309 0x00000018 WSD_PYRAMIDS_CREATEBRICK
0x00000322 0x0000001B WSD_PYRAMIDS_HIGHJUMPIMPACT
0x0000033E 0x00000012 WSD_PYRAMIDS_DEATH
0x00000351 0x00000012 WSD_PYRAMIDS_CLOCK
0x00000364 0x00000019 WSD_PYRAMIDS_DESTROYBRICK
0x0000037E 0x00000014 WSD_PYRAMIDS_TRIGGER
0x00000393 0x00000013 WSD_PYRAMIDS_BLADES
0x000003A7 0x00000011 WSD_PYRAMIDS_BOOM
0x000003B9 0x00000017 WSD_PYRAMIDS_FALLIMPACT
0x000003D1 0x00000019 WSD_PYRAMIDS_FANTOMEDEATH
0x000003EB 0x00000011 WSD_PYRAMIDS_STAR
0x000003FD 0x00000015 WSD_PYRAMIDS_TIMESTOP
0x00000413 0x00000015 WSD_PYRAMIDS_FIREBALL
0x00000429 0x00000016 WSD_PYRAMIDS_FOOTSTEPS
0x00000440 0x00000016 WSD_PYRAMIDS_GRABBONUS
0x00000457 0x00000011 WSD_PYRAMIDS_JUMP
0x00000469 0x00000017 WSD_PYRAMIDS_METALDEATH
0x00000481 0x00000013 WSD_PYRAMIDS_FUMBLE
0x00000495 0x00000015 WSD_PYRAMIDS_OPENDOOR
0x000004AB 0x00000016 WSD_PYRAMIDS_TETEDEATH
0x000004C2 0x00000016 WSD_PYRAMIDS_TETESPAWN
0x000004D9 0x00000017 WSD_PYRAMIDS_TOUCHBRICK
0x000004F1 0x00000012 WSD_PYRAMIDS_VENIN
0x00000504 0x00000016 WSD_PYRAMIDS_INTERFACE
0x0000051B 0x00000015 WSD_PYRAMIDS_GAMEOVER
0x00000531 0x00000019 WSD_PYRAMIDS_INTROELEMENT
0x0000054B 0x0000001B WSD_PYRAMIDS_LEVELCOMPLETED
0x00000567 0x00000018 WSD_PYRAMIDS_FALLIMPACT0
0x00000580 0x00000016 WSD_PYRAMIDS_MENUCLOSE
0x00000597 0x00000015 WSD_PYRAMIDS_MENUOPEN
0x000005AD 0x0000001A WSD_PYRAMIDS_QRCODESUCCESS
0x000005C8 0x0000001B WSD_PYRAMIDS_SCARABBUZZLOOP
0x000005E4 0x00000018 WSD_PYRAMIDS_SCARABDEATH
0x000005FD 0x00000008 WSDSET_0
0x00000606 0x00000008 PLAYER_0
0x00000CC0 0x00000005 INFO@
0x00001E30 0x0000001E stream/STRM_MUSIC_BHURMA.bcstm
0x00001E5C 0x0000001E stream/STRM_PYRAMID_MENU.bcstm
0x00001E88 0x00000021 stream/STRM_PYRAMID_CREDITS.bcstm
0x00001F00 0x00000004 FILE
0x00001F20 0x00000004 CWSD
0x00001F40 0x00000004 INFO
0x00003600 0x00000004 CWAR
0x00003640 0x00000004 INFO
0x00003820 0x00000004 FILE
0x00003840 0x00000004 CWAV
0x00003880 0x00000004 INFO
0x00003900 0x00000004 DATA

The file is 0C7700 long which might point at C being the new location for the lengths (the DS usually has it as 8 hex).

Still sample

0000000000 4353 4152 FFFE 4000 0000 0002 0077 0C00 CSAR..@[member='......']w..
0000000010 0300 0000 0020 0000 4000 0000 800C 0000 ..... ..@[member='......'].
0000000020 0120 0000 C00C 0000 4012 0000 0220 0000 . ......@.... ..
0000000030 001F 0000 0058 0C00 0000 0000 0000 0000 .....X..........
0000000040 5354 5247 800C 0000 0024 0000 1000 0000 STRG.....$......
0000000050 0124 0000 C805 0000 2B00 0000 011F 0000 .$......+.......
0000000060 0802 0000 1200 0000 011F 0000 1A02 0000 ................
0000000070 1200 0000 011F 0000 2C02 0000 1500 0000 ........,.......
0000000080 011F 0000 4102 0000 1600 0000 011F 0000 ....A...........
0000000090 5702 0000 1A00 0000 011F 0000 7102 0000 W...........q...
00000000A0 1100 0000 011F 0000 8202 0000 1400 0000 ................
00000000B0 011F 0000 9602 0000 1B00 0000 011F 0000 ................
00000000C0 B102 0000 1900 0000 011F 0000 CA02 0000 ................
00000000D0 1C00 0000 011F 0000 E602 0000 1300 0000 ................
00000000E0 011F 0000 F902 0000 1300 0000 011F 0000 ................
00000000F0 0C03 0000 1A00 0000 011F 0000 2603 0000 ............&...
0000000100 1500 0000 011F 0000 3B03 0000 1400 0000 ........;.......
0000000110 011F 0000 4F03 0000 1200 0000 011F 0000 ....O...........
0000000120 6103 0000 1800 0000 011F 0000 7903 0000 a...........y...
0000000130 1A00 0000 011F 0000 9303 0000 1200 0000 ................
0000000140 011F 0000 A503 0000 1600 0000 011F 0000 ................
0000000150 BB03 0000 1600 0000 011F 0000 D103 0000 ................
0000000160 1700 0000 011F 0000 E803 0000 1700 0000 ................
0000000170 011F 0000 FF03 0000 1200 0000 011F 0000 ................
0000000180 1104 0000 1800 0000 011F 0000 2904 0000 ............)...
0000000190 1400 0000 011F 0000 3D04 0000 1600 0000 ........=.......

The raw import of STRM_PYRAMID_MENU.bcstm in audacity did a fair attempt at removing hearing as a sense but in there seems to be various flavours of PCM or ADPCM.

Next step is probably reverse engineer the compression (it looks to be a fairly basic LZSS implementation without a terribly big gap between flags but hand decoding LZ is tedious when you have the original file there and know the method used in that implementation) although music is probably worth looking at.

 

[Fudge]

Awesome info, how exactly did you obtain the binary, if you don't mind me asking??

 

[FAST6191]

Nintendo seem to have found someone with a vague idea about security for the 3ds and the whole ROM is encrypted hence there not really being anything yet. However the developer stuff (which this was from) can do what they like and uses keys other than the official one(s) with thread being what followed my wandering around some of the random Chinese hacking sites (sadly it was in private mode so I do not have links). By the looks of things on 3dbrew and such the binary itself (which is to say actual executable code) sits aside from the general data although I am sure there will be some overlap somewhere along the way so all I have to look at is the data itself but that still provides things to do.

There may well be more out there but having got my hands on a copy of something built with the SDK I was happy enough to get started with that.

 

[porkiewpyne]

You'd better put up a BIG (red) sign saying that the 3DS is still not fully hacked yet before the n00bz come in asking "HAO TO PLAY 3DS ROMZ plox kthxbai". Just sayin'

Here lemme help you put one here first.

THE 3DS IS NOT FULLY HACKED YET AND WILL NOT PLAY 3DS ROMS!

Bah who am I kidding?


On a more serious note, what does this actually mean if you don't mind me asking?

 

[Fishaman P]

GAR! This isn't Smogon, we're not geeky enough to handle this!

 

[FAST6191]

What it means- next to nothing as far as getting code running (either on hardware or via emulation of some form) but Nintendo had a fairly complete SDK with lots of premade formats/data structures for the GBA and especially DS ( http://llref.emutalk.net/docs/ and http://www.romhacking.net/documents/469/ ) as well as the GC and Wii with most of them being interrelated in some way. Knowing these formats has allowed DS, GC and Wii hacking to blossom (the GBA is not bad either if you see the sappy sound format work) and in many cases have unknown games be open to those that can get around a GUI program rather than just those that are capable of being elbow deep in a hex editor all day.

This is then something of a little peak at some potential formats for the 3ds (and a very cursory one at that) but it is the sort of thing we deal with around here (the equivalent for the Wii- http://gbatemp.net/topic/72013-wii-decryption-tool-released/page__st__15 ) so it is here.

 

[Lucifer666]

Interesting find buddy. Followed this topic.
Hoping it doesn't end up like the decrypted firmware thread and its noob flood.

 

[Coto]

While this may be completely unfounded..

https://docs.google....2DV9cmenCl_oNNQ

CSAR (document by IBM, ORACLE oriented), as I saw here:

0000000000 4353 4152 FFFE 4000 0000 0002 0077 0C00 CSAR ..@[member='......']w..
0000000010 0300 0000 0020 0000 4000 0000 800C 0000 ..... ..@[member='......'].
0000000020 0120 0000 C00C 0000 4012 0000 0220 0000 . ......@.... ..
0000000030 001F 0000 0058 0C00 0000 0000 0000 0000 .....X..........
0000000040 5354 5247 800C 0000 0024 0000 1000 0000 STRG.....$......
0000000050 0124 0000 C805 0000 2B00 0000 011F 0000 .$......+.......
0000000060 0802 0000 1200 0000 011F 0000 1A02 0000 ................
0000000070 1200 0000 011F 0000 2C02 0000 1500 0000 ........,.......
0000000080 011F 0000 4102 0000 1600 0000 011F 0000 ....A...........
0000000090 5702 0000 1A00 0000 011F 0000 7102 0000 W...........q...
00000000A0 1100 0000 011F 0000 8202 0000 1400 0000 ................
00000000B0 011F 0000 9602 0000 1B00 0000 011F 0000 ................
00000000C0 B102 0000 1900 0000 011F 0000 CA02 0000 ................
00000000D0 1C00 0000 011F 0000 E602 0000 1300 0000 ................
00000000E0 011F 0000 F902 0000 1300 0000 011F 0000 ................
00000000F0 0C03 0000 1A00 0000 011F 0000 2603 0000 ............&...
0000000100 1500 0000 011F 0000 3B03 0000 1400 0000 ........;.......
0000000110 011F 0000 4F03 0000 1200 0000 011F 0000 ....O...........
0000000120 6103 0000 1800 0000 011F 0000 7903 0000 a...........y...
0000000130 1A00 0000 011F 0000 9303 0000 1200 0000 ................
0000000140 011F 0000 A503 0000 1600 0000 011F 0000 ................
0000000150 BB03 0000 1600 0000 011F 0000 D103 0000 ................
0000000160 1700 0000 011F 0000 E803 0000 1700 0000 ................
0000000170 011F 0000 FF03 0000 1200 0000 011F 0000 ................
0000000180 1104 0000 1800 0000 011F 0000 2904 0000 ............)...
0000000190 1400 0000 011F 0000 3D04 0000 1600 0000 ........=.......

CSAR (1st bit 4353h) seems to be a signed zip file using a custom compression, yet encryption.

"A CSAR is a container file, i.e. it contains multiple files of possibly different file types. These files are
typically organized in several subdirectories each of which contains related files (and possibly other
subdirectories etc). The current version of the specification supports CSARs that are zip files, typically
compressed.

Each CSAR must contain a subdirectory called Meta-Inf. This subdirectory must contain a so-called
manifest file. This file is named MANIFEST and has the file extension .MF. It represents metadata
of the other files in the CSAR. These metadata are given in the format of name/value pairs. These
name/value pairs are organized in blocks. Each block provides metadata of a certain artifact of the
CSAR. An empty line separates the blocks in the manifest file."

"The first block of the manifest file (Block_0 in the figure) provides metadata of the CSAR itself (e.g.
its version, creator etc). Each other block begins with a name/value pair that points to an artifact
within the CSAR by means of a pathname. The remaining name/value pairs in a block are the proper
metadata of the pointed to artifact. For example, a corresponding name/value pair specifies the
MIME-type of the artifact."

"A CSAR or a selective artifact within a CSAR may be signed. When signing an artifact of a CSAR the
digest of this artifact as well as the public key of the entity signing the artifact is included in the CSAR
together with a corresponding certificate; all of this is included in the so-called signature block file
for the signed artifact. The signature block file has an extension dependent on the algorithm used
for computing the digest (e.g. .RSA, .DSA), has the name of the signed artifact and is stored in the /
Meta-Inf directory."

Please don't min this too much as it may be completely unrelated but... the way the CSAR file inside that bcsar handles stuff from xml-like-arguments would be too much of a coincidence.

 

[3DSGuy]

a copy of the files (sadly no binary but that looks to be kept somewhat further apart) from the pyramids demo in plaintext.

BTW, just for reference, these assets would be found in the RomFS of the application's CXI. So guys, you're looking at the file formats which exist in the RomFS.

 

[Pippin666]

a copy of the files (sadly no binary but that looks to be kept somewhat further apart) from the pyramids demo in plaintext.

BTW, just for reference, these assets would be found in the RomFS of the application's CXI. So guys, you're looking at the file formats which exist in the RomFS.

BOOM, hopes out !!

Pip